International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
Git Guardian: GitHub Repository Security Scanner
Dr. A.P Srivastava¹, Priya Tyagi², Deepansh Tyagi³, Sanskriti Sharma⁴, Anuj Singh⁵
¹Supervisor, Dept. of Computer Science and Engineering, NITRA Technical Campus, Ghaziabad, India ² ,
,
B.Tech Students, Dept. of Computer Science and Engineering, NITRA Technical Campus, Ghaziabad, India
Abstract - Git Guardian is a full-stack web application designed to enhance software security by automatically scanning public GitHub repositories for sensitive data exposures and code quality issues. In the modern software development landscape, inadvertent commits of API keys, JWT tokens, private keys, and AWS credentials represent one of the most critical and common security vulnerabilities. This project delivers an end-to-end security platform that allows users to submit any public GitHub repository URL for deep scanning. The system clones the repository, traverses all source files, and applies a suite of regex-based detection patterns to identify security threats across severity levels critical, high, medium, and low. Scan results are persisted in a MongoDB database and presented to the user via an interactive React dashboard. The application also features a rolebased access control (RBAC) system distinguishing regular users from administrators, an automated scheduled scanning feature powered by BullMQ and Redis, and full activity logging. The backend is built with Node.js and Express.js, while the frontend is built using React.js, Vite, and Tailwind CSS. The system is deployable to Vercel (frontend) and Render (backend) for cloud production use.
Key Words: GitHubSecurity,RepositoryScanner,SecretDetection,RBAC,Node.js,React.js,BullMQ,MongoDB,JWT,Static Analysis
1. INTRODUCTION
The proliferation of open-source development and cloud-based version control platforms like GitHub has dramatically increasedtheriskofsensitiveinformationbeingaccidentallycommittedtopublicrepositories.Developers,especiallythose newtosoftwareengineering,frequentlycommitconfigurationfiles,environmentvariables,andcredentialtokensthatcan beexploitedbymaliciousactors.
GitGuardianaddressesthisproblemhead-onbyprovidinganautomated,user-friendlyscanningtool.Ausersimplypastes aGitHubrepositoryURL,andthesystemperformsacompletesecurityaudit checkingeveryfileforhard-codedsecrets, exposedkeys,andpoorcodepractices.Theresultsare presentedinastructured,color-codedreportwithfilenames,line numbers,severitylevels,andissuedescriptions.
The project was developed as a demonstration of modern full-stack web development principles, integrating REST API design, asynchronous job processing, database modeling, JWT authentication, and cloud deployment into a cohesive and production-readyapplication.
2. PROBLEM STATEMENT AND MOTIVATION
Accordingtomultiplesecurityresearchreports,thousandsofvalidcredentialsareexposedonGitHubeveryday.Developers oftenencounterthefollowingsecuritypitfalls:
• Accidentallycommit.envfilescontainingdatabaseURIsandAPIkeys
• Hard-codeJWTtokensorprivatekeysinsidesourcecodefortesting
• LeaveTODOcommentsrevealingincompletesecurityimplementations
• Forgettoaddsensitivefilesto.gitignorebeforetheirfirstpush
Existingenterprise-gradesolutionslikeGitGuardian(commercial)orGitHub’snativesecretscanningrequirepaidplansor arelimitedtorepositoryowners.Thereisacleargapforafree,accessibletoolthatanydevelopercanusetoauditanypublic repository.Thisprojectfillsthatgapwithalightweight,deployablewebapplication.
3. OBJECTIVES
Theprimaryobjectivesofthisprojectare:
• Todesignandimplementafull-stackwebapplicationforGitHubrepositorysecurityscanning.
• Todeveloparegex-basedcodeanalysisenginecapableofdetectingcriticalsecurityvulnerabilities.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
• ToimplementauserauthenticationsystemwithJWT-basedaccesscontrolandrole-basedpermissions.
• Tocreateanautomatedscanningschedulerthatperiodicallyauditsadeveloper’srepositories.
• TobuildanintuitiveReact.jsdashboardtovisualizescanresults,history,andstatistics.
• Todeploytheapplicationtocloudinfrastructure(Vercel+Render)forreal-worldaccessibility.
• Toimplementanactivityloggingsystemforadminoversightandaudittrails.
4. SYSTEM ARCHITECTURE
Git Guardian follows a three-tier client-server architecture with an additional asynchronous job processing layer. The systemiscomposedofthefollowingmajorcomponents:
4.1 Architecture Overview
Table -1: Architecture Layers
Layer
PresentationLayer React.js+Vite+TailwindCSS UserInterface,Dashboard,Reports
ApplicationLayer Node.js+Express.js
DataLayer MongoDB+Mongoose
JobQueueLayer BullMQ+Redis
RESTAPI,BusinessLogic,Auth
UserData,ScanRecords,ActivityLogs
AsyncScanScheduling&Processing
ExternalAPILayer GitHubRESTAPI(Octokit) RepositoryListingforAuto-Scan
4.2 Request Flow
Thedataflowforamanualscanrequestfollowsthissequence:
• UsersubmitsaGitHubrepositoryURLthroughtheReactdashboard.
• ThefrontendsendsaPOSTrequestto/api/scanswithaJWTAuthorizationheader.
• TheExpressbackendvalidatestheJWTtokenviatheauthmiddleware.
• AnewScandocumentiscreatedinMongoDBwithstatus:'queued'.
• TheprocessScan()functionisinvokedasynchronouslyasabackgroundjob.
• Theserviceclonestherepositoryusinggitclone depth1intoatemporarydirectory.
• Allsourcefilesareenumeratedandfilteredbyextension(JS,TS,PY,GO,etc.).
• Eachfileisreadandpassedthroughtheregexpatternengine.Issuesarecollected.
• ThetemporarydirectoryisdeletedandtheScandocumentisupdatedwithresults.
• Thefrontendpollsortheuserrefreshestoviewthecompletedscanresults.
5. TECHNOLOGY STACK
5.1 Backend Technologies
Table -2: Backend Technology Stack Package Version
JavaScriptruntimeforserver-sideexecution
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
jsonwebtoken
bcryptjs
BullMQ
ioredis
Octokit
helmet
axios
v9.0.3 JWTgenerationandverification
v3.0.3
v5.66.4
v5.8.2
v5.0.5
v8.1.0
v1.13.2
5.2 Frontend Technologies
Passwordhashingusingthebcryptalgorithm
Redis-backedmessagequeueforbackgroundjobs
RedisclientforNode.js
OfficialGitHubRESTAPIclientlibrary
HTTPsecurityheadermiddleware
HTTPclientformakingAPIrequests
Table -3: Frontend Technology Stack
Package
React.js
Vite
TailwindCSS
ReactRouterDOM
Recharts
FramerMotion
LucideReact
ReactToastify
Axios
v18.2.0
v7.3.1
v3.3.5
v6.18.0
v3.6.0
v10.16.4
v0.292.0
v9.1.3
v1.6.0
6. MODULES AND FEATURES
6.1 User Authentication Module
Component-basedUIlibrary
Next-generationfrontendbuildtool
Utility-firstCSSframeworkforstyling
Client-sideroutingandnavigation
Chartlibraryforscanstatistics
AnimationlibraryforReact
IconsetforUIcomponents
Toastnotificationsystem
HTTPclientforAPIcommunication
The authentication system uses JSON Web Tokens (JWT) for stateless session management. Passwords are hashed using bcryptjswithasaltfactorof10beforestorageinMongoDB.Thetokenhasa30-dayexpiration.Allprotectedroutespass through the AUTH Middleware, which verifies the token and attaches the user object to the request context. Available authentication endpoints include: POST /api/auth/register to create a new user account; POST /api/auth/login to authenticate and receive a JWT token; GET /api/auth/me to retrieve the authenticated user’s profile; and PUT /api/auth/profiletoupdateGitHubusername,token,andauto-scansettings.
6.2 Scan Management Module
Thisisthecoremoduleoftheapplication.Itexposesendpointstocreate,retrieve,andcancelscans.Eachscanisassociated withauser,hasastatuslifecycle(queued→scanning→completed/failed),andstoresstructuredresultsincludingissue type,severity,affectedfile,andlinenumber.
6.3 Admin Module
Administratorshaveaccesstoaseparatedashboardprovidingaplatform-wideviewofallusersandtheiractivities.Admin privileges are granted via the isAdmin flag in the User model and enforced through a dedicated adminMiddleware. The adminpanelincludesusermanagement,activitylogviewerwithIPaddresstracking,andplatform-widescanstatistics.
International
2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
6.4 Automated Scanning Module
UserscanenabletheAuto-Scanfeatureintheirprofilesettings,specifyingascaninterval(default:7days).Thescheduler runs as a Node.js setInterval loop that checks every hour for users whose auto-scan interval has elapsed. When due, the user’stop5mostrecentlyupdatedGitHubrepositoriesarefetchedviatheOctokitAPIandqueuedforscanningusingBullMQ withaRedisbackend.
6.5 Activity Logging Module
EverysignificantuseractionisrecordedintheActivityLogcollectioninMongoDB.Loggedeventsinclude:REGISTER,LOGIN, SCAN_CREATED, and SCAN_CANCELLED. Each log entry captures the user ID, action type, additional details (such as the repositoryURL),andtheclient’sIPaddress.Thisprovidesafullaudittrailforadminreview.
6.6 GitHub Repository Browser
When a user links their GitHub username to their profile, the dashboard provides a New Scan page that allows them to browse their public repositories via the GitHub API proxy route (/api/scans/github/:username). They can then select a repositorydirectlytopopulatethescanURLfield,makingiteasiertosubmitscanswithoutmanuallycopyingURLs.
7. DATABASE DESIGN
The application usesMongoDBasits primarydatabase,accessedvia the Mongoose ODM. The schema design reflectsthe threecoreentitiesofthesystem:
7.1 User Schema
Table -4: User Schema
Field Type Description
name String(required)
email String(unique,req.)
password String(required)
githubToken String
githubUsername String
Fullnameoftheuser
Useremailusedasloginidentifier
Bcrypt-hashedpassword
OptionalpersonalGitHubaccesstoken
GitHubusernameforrepositorybrowsing isAdmin Boolean(def:false)
autoScanEnabled Boolean(def:false)
autoScanInterval Number(def:7)
lastAutoScan Date
7.2 Scan Schema
Table -5: Scan Schema
Field Type
Adminprivilegeflag
Toggleforautomatedscanning
Daysbetweenautomatedscans
Timestampofthelastautomatedscan
user ObjectId(ref:User) Ownerofthescan
repoUrl String(required)
Description
FullURLofthescannedGitHubrepository status Enum queued|scanning|completed|failed
scanType Enum manual|automated
results.issues ArrayofObjects
Detectedissueswithtype,severity,file,line results.stats Object
Countsperseverity:critical,high,medium,low
error String Errormessageifscanfailed
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
8. API REFERENCE
Table -6: API Endpoints
Method
Endpoint
POST /api/auth/register
POST /api/auth/login
GET /api/auth/me
PUT /api/auth/profile
POST /api/scans
GET /api/scans
GET /api/scans/:id
POST /api/scans/:id/cancel
GET /api/scans/github/:username
GET /api/admin/users
GET /api/admin/activity
GET /api/health
9. SECURITY ANALYSIS ENGINE
Auth Description
Public Registeranewuseraccount
Public LoginandreceiveaJWTtoken
Private Getcurrentauthenticateduserprofile
Private Updateuserprofileandscanpreferences
Private Initiateanewrepositoryscan
Private Getallscansfortheauthenticateduser
Private GetaspecificscanbyID
Private Cancelanactivein-progressscan
Private Fetchuser'spublicGitHubrepositories
Admin Getallregisteredusers
Admin Getplatform-wideactivitylogs
Public Healthcheckendpoint
The core scanning logic resides in backend/services/scanService.js. It implements a pattern-matching engine using JavaScriptregularexpressionsappliedline-by-lineacrossallsourcefilesintheclonedrepository.
9.1 Detection Patterns
Table -7: Detection Pattern Matrix
aws_key Critical AWSAccessKeyID /[A-Z0-9]{20}/g
aws_secret Critical AWSSecretAccessKey /[A-Za-z0-9/+=]{40}/g jwt High HardcodedJWTToken /eyJ[A-Za-z0-9-_]+.../g
private_key Critical PEMPrivateKeyBlock / BEGINPRIVATEKEY /g
generic_api_key High GenericAPIKey /api_key\s*[:=]\s*'.../gi .envfile Critical EnvironmentConfigFile Filepathendswith.env
console_log Low DebugPrintStatement /console\.log\s*\(/g todo Low TODOComments /\/\/\s*TODO:/g
9.2 Scan Process Details
The scanning process follows a carefully designed pipeline: URL Normalization ensures the repository URL begins with https://forgitclonecompatibility.RepositoryCloningusesgitclone depth1tofetchonlythelatestcommit.FileDiscovery recursively enumerates all files, excluding .git and node_modules directories. File Type Filtering scans only files with relevantextensions(.js,.ts,.env,.json,.py,.go,.rb,etc.).ChunkProcessinghandlesfilesinbatchesof25usingPromise.all()
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
for parallel execution. Issue Aggregation stores all detected issues with file path, line number, severity, and description. Finally,theScandocumentisupdatedinMongoDBwithcompleteresultsandthetemporaryclonedirectoryisremoved.
10. AUTO-SCAN SCHEDULER
The automated scanning feature provides developers with passive, continuous security monitoring of their GitHub repositorieswithoutmanualintervention.Thismoduleisimplementedinbackend/jobs/autoScan.js.
10.1 Architecture
The schedulerusestwocomponentsfromthe BullMQlibrary:a Queue anda Worker,bothbackedbya Redisconnection managed by ioredis. The system is designed to be fault-tolerant if Redis is unavailable, the application continues to functionnormallyformanualscanswhileloggingasinglewarning.
10.2 Scheduling Logic
AsetIntervalloopexecutesevery3,600,000milliseconds(1hour).Oneachexecution,alluserswithautoScanEnabled=true are fetched from the database. The current timestamp is compared against each user’s lastAutoScan date plus their configuredautoScanIntervalindays.Iftheintervalhaselapsed,anewjobispushedtotheBullMQscan-queue.TheWorker picks up the job, fetches the user’s top 5 GitHub repositories via Octokit, and sequentially scans each using the same processScan()function.Theuser’slastAutoScantimestampisupdatedafterallscanscomplete.
10.3 User Configuration
Userscanconfiguretheauto-scanfeaturefromtheirprofilepageinthedashboard.TheymustsettheirGitHubusernameto enable the feature. The scan interval can be customized in days (default: 7 days). Auto-scans create Scan records with scanType:'automated'sotheyaredistinguishablefrommanualscansinthehistoryview.
11. FRONTEND DESIGN
ThefrontendisaSinglePageApplication(SPA)builtwithReact.jsandVite.NavigationishandledbyReactRouterDOMv6 with protected routes. The application is styled entirely with Tailwind CSS utility classes, with Framer Motion providing smoothpageandcomponenttransitions.
11.1 Application Pages
Table -8: Application Pages
Page / Component
Login /login
Register /register
Dashboard /dashboard
NewScanTab /dashboard/new-scan
ScansHistory /dashboard/scans
Auto-ScanTab /dashboard/auto-scan
ScanDetails /scan/:id
AdminDashboard /admin
ProfilePage /dashboard/profile
11.2 State Management and API Layer
Userauthenticationformwithtoastfeedback
Accountcreationwithvalidation
Mainuserworkspacewithtabbednavigation
URLinputform+GitHubrepobrowser
Paginatedtableofalluserscans
Enable/configureautomatedscanning
Fullreport:issuelist,severitychart
Admin-only:userlist,activitylogs
UpdateGitHubcredentialsandpreferences
GlobalauthenticationstateismanagedviaReactContextAPI(AuthContext.jsx).Thecontextprovidesthecurrentuserobject and JWT token to all components. A centralized api.js service file configures an Axios instance with the base URL and automaticallyattachestheAuthorizationheaderfromlocalStorage.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
11.3 Route Protection
TheProtectedLayout.jsxcomponentwrapsallauthenticatedroutes.ItreadstheAuthContexttoverifythepresenceofavalid usersession.If the user is notauthenticated, theyare redirectedto the /loginpage.Admin routesadditionallycheck the isAdminflagbeforerenderingadmin-specificcomponents.
12. DEPLOYMENT
Git Guardian is configured for cloud deployment with separate hosting for the frontend and backend, following modern decoupleddeploymentpractices.
12.1 Backend Deployment – Render
TheNode.js/ExpressbackendisdeployedtoRenderasaWebService.Theserver.jsfileincludesenvironmentdetectionlogic to avoid running interval-based schedulers in serverless environments. A vercel.json configuration file is included for optionalVercelserverlessdeploymentofthebackendaswell.
12.2 Frontend Deployment – Vercel
TheReactfrontendbuiltwithViteisdeployedtoVercel.Thefrontend.env.productionfilecontainstheproductionAPIbase URLpointingtotheRenderbackend.Vercel’sautomaticGitHubintegrationenablescontinuousdeploymentoneverypush tothemainbranch.
12.3 Environment Variables
Table -9: Environment Variables
Variable Location Description
MONGO_URI
Backend.env MongoDBconnectionstring(Atlasorlocal)
JWT_SECRET Backend.env SecretkeyforsigningJWTtokens
GITHUB_TOKEN
REDIS_HOST
REDIS_PORT
Backend.env
GitHubpersonalaccesstokenforAPIratelimits
Backend.env Redisserverhostname(default:127.0.0.1)
Backend.env Redisserverport(default:6379)
PORT Backend.env Expressserverport(default:5000)
VITE_API_URL
13. TESTING
13.1 Manual Testing
Frontend.env BackendAPIbaseURLforAxios
Theapplicationwastestedmanuallyacrossmultiplescenariosincluding:Authentication(registrationwithexistingemail conflict check, login with wrong password 401, JWT expiry handling); Scanning (public repos with known secrets, repos with .env files, private repos expected failure, malformed URLs, rate-limited GitHub requests); Admin Panel (verifying admin-only access restriction, viewing all users, browsing activity logs); and Auto-Scan (enabling auto-scan, verifying BullMQjobcreation,confirmingscanrecordsarecreatedwithscanType:'automated').
13.2 Error Handling Scenarios
Table -10: Error Handling
Scenario
Invalid/privaterepositoryURL
Gitclonetimeout(>60seconds)
Expected Behavior
Scanstatussetto'failed'withdescriptiveerrormessage
Processabortedafter3retryattemptswitherrorlogged
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
Redisunavailable
Useraccessesanotheruser'sscan
Non-adminaccessesadminroutes
Scancancelledmid-process
14. RESULTS AND KEY FINDINGS
Applicationcontinues;auto-scandisabledgracefullywithwarninglog
401Unauthorizedresponsereturned
403Forbiddenresponsereturned
Processchecksstatusflagandaborts;tempdircleanedup
During development and testing, Git Guardian successfully detected security issues in multiple real-world public repositories.Thefollowingtablesummarizestypicaldetectionperformance:
Table -11: Detection Performance Summary
AWSAccessKeyID(AKIA...)
JWTTokens(eyJ...)
PrivateKeyBlocks(PEM)
.envFilePresentinRepo
console.logStatements
TODO
Generic
15. LIMITATIONS AND FUTURE SCOPE
15.1 Current Limitations
• The scanner onlysupportspublic repositories. Private repositories require a GitHub personal accesstoken with repo scope,whichisnotcurrentlywiredintothecloneprocess.
• The detection engine uses static regex patterns and may produce false positives (e.g., flagging test fixtures that intentionallylooklikeAPIkeys).
• Thesystemdoesnotscangitcommithistory onlythelateststateoftherepositoryisanalyzed.
• Binaryfilesandfileswithencodingerrorsaresilentlyskipped.
• Largerepositories(>500MB)mayexceedthe60-secondclonetimeout.
15.2 Future Enhancements
• GitHistoryScanning:Traverseallcommitstodetectsecretsthatwerepreviouslycommittedbutlaterremoved.
• SASTIntegration:IntegrateestablishedtoolslikeSemgreporBanditfordeeperstaticanalysisbeyondregex.
• WebhookSupport:AllowGitHubwebhookstotriggerautomaticscansoneverypushevent.
• RemediationGuidance:Provideactionablefixrecommendationsalongsideeachdetectedissue.
• Email/SlackNotifications:Notifyuserswhenascancompletesorcriticalissuesarefound.
• PDFReportExport:AllowuserstodownloadafullPDFreportofanyscan.
• PrivateRepositorySupport:OAuth2.0GitHubintegrationforprivaterepositories.
• MachineLearningEnhancement:TrainanMLmodeltoreducefalsepositivesinAPIkeydetection.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
16. CONCLUSIONS
GitGuardiansuccessfullydemonstratesthedesignanddevelopmentofapractical,end-to-endwebapplicationforGitHub repositorysecurityscanning.Theprojectintegratesawiderangeofmodernwebtechnologies fromJWTauthentication andMongoDBdatamodelingonthebackendtoReactcomponentarchitectureandTailwindCSSonthefrontend.
The core security analysis engine provides meaningful detection of critical vulnerability categories including hardcoded credentials,AWSkeys,andexposedprivatekeys.The automatedschedulingfeatureextendsthetool’sutilityfroma onetimeaudittoolintoapassivesecuritymonitoringplatform.
This project provided hands-on experience in full-stack web development, RESTful API design, database schema design, asynchronousjobprocessing,clouddeployment,andsecurityengineeringprinciples.Itrepresentsastrongfoundationfor aproduction-gradesecuritytoolthatcouldbeextendedwiththeenhancementsoutlinedabove.
ACKNOWLEDGEMENT
TheauthorsgratefullyacknowledgetheguidanceandsupportoftheDepartmentofComputerScienceandEngineeringat NITRATechnicalCampus,Ghaziabad.Wealsothankthe open-sourcecommunityforprovidingthetoolsandframeworks thatmadethisprojectpossible.
REFERENCES
[1]Express.jsOfficialDocumentation–https://expressjs.com/
[2]MongooseODMDocumentation–https://mongoosejs.com/docs/
[3]React.jsOfficialDocumentation–https://react.dev/
[4]ViteBuildTool–https://vitejs.dev/
[5]TailwindCSS–https://tailwindcss.com/docs/
[6]BullMQDocumentation–https://docs.bullmq.io/
[7]Octokit–GitHubRESTAPIClient–https://github.com/octokit/octokit.js/
[8]jsonwebtoken–https://www.npmjs.com/package/jsonwebtoken
[9]OWASPTop10SecurityRisks–https://owasp.org/www-project-top-ten/
[10]GitHubDocs:SecretScanning–https://docs.github.com/en/code-security/secret-scanning/
[11]MongoDBAtlasDocumentation–https://www.mongodb.com/docs/atlas/
[12]VercelDeploymentDocumentation–https://vercel.com/docs